{"id":"CVE-2026-46176","revision":"b39d1ab8ff7e43269fe0aa2024e6cfec","records":[{"revision":"b39d1ab8ff7e43269fe0aa2024e6cfec","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-46176","aliases":[],"title":"RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()\n\nmlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When\nib_create_srq() fails for s1, the error branch destroys s0 but falls\nthrough and unconditionally assigns the freed s0 and the ERR_PTR s1 to\ndevr->s0 and devr->s1.\n\nThis leads to several problems: the lock-free fast path checks\n\"if (devr->s1) return 0;\" and treats the ERR_PTR as already initialised;\nusers in mlx5_ib_create_qp() dereference the freed SRQ or ERR_PTR via\nto_msrq(devr->s0)->msrq.srqn; and mlx5_ib_dev_res_cleanup() dereferences\nthe ERR_PTR and double-frees s0 on teardown.\n\nFix by adding the same `goto unlock` in the s1 failure path.","state":0,"publishedAt":"2026-05-28T09:36:30.398+00:00","modifiedAt":"2026-10-19T19:36:53.745+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/infiniband/hw/mlx5/main.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"b6334d2356fc0922ed01457960f74923058a353a\",\n                            \"lessThan\": \"a13c2ac4d480b734342c6fbf8249fc48afd675f3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5895e70f2e6e8dc67b551ca554d6fcde0a7f0467\",\n                            \"lessThan\": \"bc2cf5935b4665172235341163315905197ae91d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5895e70f2e6e8dc67b551ca554d6fcde0a7f0467\",\n                            \"lessThan\": \"b087913ae88256df66620f7ba0a9776716aeef7e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5895e70f2e6e8dc67b551ca554d6fcde0a7f0467\",\n                            \"lessThan\": \"6fd93142dd1d09000c3750af08270f5792523fe9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5895e70f2e6e8dc67b551ca554d6fcde0a7f0467\",\n                            \"lessThan\": \"c488df06bd552bb8b6e14fa0cfd5ad986c6e9525\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.64\",\n                            \"lessThan\": \"6.6.140\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/infiniband/hw/mlx5/main.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.140\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.88\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.30\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.7\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/a13c2ac4d480b734342c6fbf8249fc48afd675f3","https://git.kernel.org/stable/c/bc2cf5935b4665172235341163315905197ae91d","https://git.kernel.org/stable/c/b087913ae88256df66620f7ba0a9776716aeef7e","https://git.kernel.org/stable/c/6fd93142dd1d09000c3750af08270f5792523fe9","https://git.kernel.org/stable/c/c488df06bd552bb8b6e14fa0cfd5ad986c6e9525"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46176","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-46176","identifiers":["CVE-2026-46176"]},"retained":false,"historicalAffected":[]}],"coverage":[]}